Sat Jun 7 02:47:42 UTC 2014patches/packages/mozilla-firefox-24.6.0esr-x86_64-1_slack14.1.txz: Upgraded. This release contains security fixes and improvements. For more information, see: http://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html (* Security fix *)+--------------------------+Fri Jun 6 04:27:01 UTC 2014patches/packages/gnutls-3.1.25-x86_64-1_slack14.1.txz: Upgraded. A security issue has been corrected in gnutls. This vulnerability affects the client side of the gnutls library. A server that sends a specially crafted ServerHello could corrupt the memory of a requesting client. This may allow a remote attacker to execute arbitrary code. Additional vulnerabilities in the embedded libtasn1 library have also been patched. Thanks to mancha for the backported patches. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3465 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3466 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469 (* Security fix *)patches/packages/libtasn1-3.6-x86_64-1_slack14.1.txz: Upgraded. Multiple security issues have been corrected in the libtasn1 library. These errors allow a remote attacker to cause a denial of service, or possibly to execute arbitrary code. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3467 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3468 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3469 (* Security fix *)patches/packages/openssl-1.0.1h-x86_64-1_slack14.1.txz: Upgraded. Multiple security issues have been corrected, including a possible man-in-the-middle attack where weak keying material is forced, denial of service, and the execution of arbitrary code. For more information, see: http://www.openssl.org/news/secadv_20140605.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5298 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0195 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0198 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0221 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0224 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3470 (* Security fix *)patches/packages/openssl-solibs-1.0.1h-x86_64-1_slack14.1.txz: Upgraded.patches/packages/sendmail-8.14.9-x86_64-1_slack14.1.txz: Upgraded. This release fixes one security related bug by properly closing file descriptors (except stdin, stdout, and stderr) before executing programs. This bug could enable local users to interfere with an open SMTP connection if they can execute their own program for mail delivery (e.g., via procmail or the prog mailer). For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3956 (* Security fix *)patches/packages/sendmail-cf-8.14.9-noarch-1_slack14.1.txz: Upgraded.+--------------------------+

Mon Jun 9 20:16:02 UTC 2014patches/packages/php-5.4.29-x86_64-1_slack14.1.txz: Upgraded. This update fixes bugs and security issues, including a possible denial of service, and an issue where insecure default permissions on the FPM socket may allow local users to run arbitrary code as the apache user. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0185 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0237 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0238 (* Security fix *)+--------------------------+

Tue Jun 24 22:35:07 UTC 2014patches/packages/bind-9.9.5_P1-x86_64-1_slack14.1.txz: Upgraded. This fixes security issues and other bugs. Please note that the first CVE only affects Windows, and the second one was claimed to be fixed by an earlier version of BIND. But we'll update anyway just in case. :-) For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6230 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0591 (* Security fix *)patches/packages/gnupg-1.4.17-x86_64-1_slack14.1.txz: Upgraded. This release includes a security fix to stop a denial of service using garbled compressed data packets which can be used to put gpg into an infinite loop. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4617 (* Security fix *)patches/packages/gnupg2-2.0.24-x86_64-1_slack14.1.txz: Upgraded. This release includes a security fix to stop a denial of service using garbled compressed data packets which can be used to put gpg into an infinite loop. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4617 (* Security fix *)patches/packages/samba-4.1.9-x86_64-1_slack14.1.txz: Upgraded. This update fixes bugs and security issues, including a flaw in Samba's internal DNS server which can be exploited to cause a denial of service, a flaw in SRV_SNAPSHOT_ARRAY that permits attackers to leverage configurations that use shadow_copy* for vfs objects to reveal potentially private server information, a denial of service on the nmbd NetBIOS name services daemon, and a denial of service crash involving overwriting memory on an authenticated connection to the smbd file server. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0178 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0239 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0244 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3493 (* Security fix *)patches/packages/seamonkey-2.26.1-x86_64-1_slack14.1.txz: Upgraded. This update contains security fixes and improvements. For more information, see: http://www.mozilla.org/security/known-vulnerabilities/seamonkey.html (* Security fix *)patches/packages/seamonkey-solibs-2.26.1-x86_64-1_slack14.1.txz: Upgraded.+--------------------------+

Fri Aug 1 21:13:18 UTC 2014patches/packages/dhcpcd-6.0.5-x86_64-3_slack14.1.txz: Rebuilt. This update fixes a security issue where a specially crafted packet received from a malicious DHCP server causes dhcpcd to enter an infinite loop causing a denial of service. Thanks to Tobias Stoeckmann for the bug report. (* Security fix *)patches/packages/samba-4.1.11-x86_64-1_slack14.1.txz: Upgraded. This update fixes a remote code execution attack on unauthenticated nmbd NetBIOS name services. A malicious browser can send packets that may overwrite the heap of the target nmbd NetBIOS name services daemon. It may be possible to use this to generate a remote code execution vulnerability as the superuser (root). For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3560 (* Security fix *)patches/packages/xscreensaver-5.29-x86_64-1_slack14.1.txz: Upgraded. Disabled nag screen that says "This version of XScreenSaver is very old! Please upgrade!" when the age of the software exceeds 12 months.+--------------------------+

Wed Sep 24 22:52:53 UTC 2014patches/packages/bash-4.2.048-x86_64-1_slack14.1.txz: Upgraded. This update fixes a vulnerability in bash related to how environment variables are processed: trailing code in function definitions was executed, independent of the variable name. In many common configurations (such as the use of CGI scripts), this vulnerability is exploitable over the network. Thanks to Stephane Chazelas for discovering this issue. For more information, see: http://seclists.org/oss-sec/2014/q3/650 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6271 (* Security fix *)patches/packages/mozilla-nss-3.16.5-x86_64-1_slack14.1.txz: Upgraded. Fixed an RSA Signature Forgery vulnerability. For more information, see: https://www.mozilla.org/security/announce/2014/mfsa2014-73.html (* Security fix *)+--------------------------+